jishushell 0.5.22 → 0.6.18

package/dist/services/setup-manager.js

@@ -1,2149 +0,0 @@
-import { execFileSync, execSync, spawn as nodeSpawn } from "child_process";
-import { chmodSync, copyFileSync, existsSync, mkdtempSync, readFileSync, renameSync, rmSync, symlinkSync, unlinkSync } from "fs";
-import { userInfo, platform as osPlatform, arch as osArch, cpus as osCpus } from "node:os";
-import { randomBytes } from "node:crypto";
-import { tmpdir } from "node:os";
-import { dirname, join } from "path";
-import { StringDecoder } from "string_decoder";
-import { fileURLToPath } from "url";
-import { JISHUSHELL_HOME, getPanelConfig, savePanelConfig, setOpenclawDockerImage, getOpenclawDockerImage, DEFAULT_OPENCLAW_DOCKER_IMAGE, getRuntimeCatalogEntry, OPENCLAW_MODULES, OPENCLAW_BIN_DIR, } from "../config.js";
-import { ensureDirContainer, ensureDirHost, writeConfigFile, writeSecretFile, writeExecutableFile, writeSystemTmpFile } from "../utils/fs.js";
-import { buildDockerClientEnv, managedColimaSocketPath, managedColimaDockerHost, resolveDockerHost } from "../utils/docker-host.js";
-import { appleSiliconGuard, buildColimaWrapperScript, buildColimaPlist, buildNomadWaitWrapper, buildNomadPlist, buildPanelGateWrapper, buildPanelPlist, } from "./macos-launchd.js";
-import { getAdapter, listRegisteredAdapters } from "./runtime/index.js";
-// Internal usage of task primitives — re-exports further down preserve the
-// public import surface used by runtime/adapters/*, routes, and CLI.
-import { createTask, emitTask, getRunningTasks } from "./task-registry.js";
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-// ── Paths ──────────────────────────────────────────────────────────
-const BIN_DIR = join(JISHUSHELL_HOME, "bin");
-const NOMAD_BIN = join(BIN_DIR, "nomad");
-const NOMAD_CONFIG_DIR = join(JISHUSHELL_HOME, "nomad");
-const NOMAD_DATA_DIR = join(JISHUSHELL_HOME, "nomad", "data");
-const NOMAD_ALLOC_DIR = join(JISHUSHELL_HOME, "nomad", "data", "alloc");
-const _COLIMA_DIR = join(JISHUSHELL_HOME, "colima");
-const COLIMA_PROFILE = "jishushell";
-const _COLIMA_SOCKET = managedColimaSocketPath(JISHUSHELL_HOME, COLIMA_PROFILE);
-const NOMAD_VERSION = "1.6.5";
-let _serverPort = 8090;
-export function setServerPort(port) { _serverPort = port; }
-// ── Resolve non-root service user (board-agnostic) ─────────────────
-/**
- * Determine which user the systemd service should run as.
- *
- * Strategy (in order):
- *  1. If current process is NOT root, return the real username directly.
- *  2. Under sudo, trust the kernel-set SUDO_UID (numeric, hard to spoof)
- *     and reverse-lookup via `getent passwd <uid>`.
- *  3. Fallback: scan /etc/passwd for the first user with UID >= 1000
- *     (works on any board — pi, orangepi, rock, nvidia, etc.).
- *  4. Throw instead of guessing — running as the wrong user is worse
- *     than a visible installation error.
- */
-function resolveServiceUser() {
-    const current = userInfo();
-    if (current.uid !== 0)
-        return current.username;
-    // Under sudo: SUDO_UID is set by the kernel and is numeric
-    const sudoUid = parseInt(process.env.SUDO_UID || "", 10);
-    if (Number.isFinite(sudoUid) && sudoUid >= 1000) {
-        try {
-            const entry = execFileSync("getent", ["passwd", String(sudoUid)], {
-                encoding: "utf8",
-                timeout: 3000,
-            }).trim();
-            const name = entry.split(":")[0];
-            if (name)
-                return name;
-        }
-        catch { /* getent failed, continue */ }
-    }
-    // Board-agnostic fallback: first real user (UID >= 1000, exclude nobody)
-    try {
-        const firstUser = execFileSync("getent", ["passwd"], {
-            encoding: "utf8",
-            timeout: 3000,
-        })
-            .split("\n")
-            .map((line) => line.split(":"))
-            .find((cols) => {
-            const uid = parseInt(cols[2], 10);
-            return uid >= 1000 && uid < 65534;
-        });
-        if (firstUser?.[0])
-            return firstUser[0];
-    }
-    catch { /* /etc/passwd unreadable */ }
-    throw new Error("Cannot determine service user. Run with a non-root user or set SUDO_UID.");
-}
-// ── Task tracker (for SSE progress) ────────────────────────────────
-// Storage, event dispatch, and subscribe plumbing now live in
-// task-registry.ts so non-setup callers (runtime-apps/*) can publish
-// tasks without pulling in the rest of setup-manager's bootstrap
-// surface. These re-exports preserve the original import surface used
-// by runtime/adapters/*, routes, and CLI.
-export { createTask, emitTask, getTask, getTaskSnapshot, getRunningTasks, subscribeTask, } from "./task-registry.js";
-const ANSI_ESCAPE_RE = /\u001B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])/g;
-function sanitizeTaskLine(line) {
-    return line
-        .replace(ANSI_ESCAPE_RE, "")
-        .replace(/[\u0000-\u0008\u000B-\u001F\u007F]/g, "")
-        .trimEnd();
-}
-/** Run a shell command as a spawned process, streaming output to a task */
-export function spawnWithTask(task, cmd, args, options = {}) {
-    return new Promise((resolve) => {
-        const env = { ...process.env, ...options.env };
-        const child = nodeSpawn(cmd, args, {
-            env,
-            cwd: options.cwd,
-            timeout: options.timeout || 600000,
-        });
-        let output = "";
-        const stdoutDecoder = new StringDecoder("utf8");
-        const stderrDecoder = new StringDecoder("utf8");
-        let stdoutPending = "";
-        let stderrPending = "";
-        const emitLine = (rawLine) => {
-            const line = sanitizeTaskLine(rawLine);
-            if (!line.trim())
-                return;
-            // Try to parse progress
-            if (options.progressParser) {
-                const pct = options.progressParser(line);
-                if (pct !== null) {
-                    emitTask(task, { type: "progress", message: line, progress: pct });
-                    return;
-                }
-            }
-            emitTask(task, { type: "log", message: line });
-        };
-        const handleDecodedText = (text, stream) => {
-            if (!text)
-                return;
-            output += text;
-            const normalized = `${stream === "stdout" ? stdoutPending : stderrPending}${text}`
-                .replace(/\r\n/g, "\n")
-                .replace(/\r/g, "\n");
-            const lines = normalized.split("\n");
-            const pending = lines.pop() ?? "";
-            if (stream === "stdout")
-                stdoutPending = pending;
-            else
-                stderrPending = pending;
-            for (const line of lines) {
-                emitLine(line);
-            }
-        };
-        child.stdout?.on("data", (data) => {
-            handleDecodedText(stdoutDecoder.write(data), "stdout");
-        });
-        child.stderr?.on("data", (data) => {
-            handleDecodedText(stderrDecoder.write(data), "stderr");
-        });
-        child.on("close", (code) => {
-            handleDecodedText(stdoutDecoder.end(), "stdout");
-            handleDecodedText(stderrDecoder.end(), "stderr");
-            emitLine(stdoutPending);
-            emitLine(stderrPending);
-            resolve({ ok: code === 0, output });
-        });
-        child.on("error", (err) => {
-            emitTask(task, { type: "log", message: `Error: ${err.message}` });
-            resolve({ ok: false, output: err.message });
-        });
-    });
-}
-// ── Progress parsers ───────────────────────────────────────────────
-export function npmProgressParser(line) {
-    // npm shows "added X packages" at the end
-    if (line.includes("added") && line.includes("packages"))
-        return 100;
-    // npm progress: "reify:packagename: timing"
-    if (line.includes("reify:"))
-        return null; // just a log line
-    return null;
-}
-export function dockerBuildProgressParser(line) {
-    // Docker build steps: "Step 1/6", "Step 2/6", etc.
-    const legacyMatch = line.match(/Step\s+(\d+)\/(\d+)/);
-    if (legacyMatch) {
-        return Math.round((parseInt(legacyMatch[1], 10) / parseInt(legacyMatch[2], 10)) * 100);
-    }
-    // BuildKit plain output: "#5 [2/4] COPY node_modules ..."
-    const buildkitMatch = line.match(/\[(\d+)\/(\d+)\]/);
-    if (buildkitMatch) {
-        return Math.round((parseInt(buildkitMatch[1], 10) / parseInt(buildkitMatch[2], 10)) * 100);
-    }
-    if (/exporting to image/i.test(line))
-        return 95;
-    if (/naming to /i.test(line))
-        return 98;
-    return null;
-}
-function curlProgressParser(line) {
-    // curl with -# shows progress
-    const match = line.match(/(\d+\.?\d*)%/);
-    if (match)
-        return Math.round(parseFloat(match[1]));
-    return null;
-}
-// ── Dir size tracker for npm installs ──────────────────────────────
-export function getDirSizeMB(dir) {
-    try {
-        const result = execFileSync("du", ["-sm", dir], { encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
-        return parseInt(result.split("\t")[0], 10) || 0;
-    }
-    catch {
-        return 0;
-    }
-}
-function checkCommand(cmd, versionFlag = "--version") {
-    try {
-        const version = execFileSync(cmd, [versionFlag], { encoding: "utf-8", timeout: 10000, stdio: ["pipe", "pipe", "pipe"] }).trim();
-        let cmdPath = "";
-        try {
-            cmdPath = execFileSync("which", [cmd], { encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] }).trim();
-        }
-        catch { }
-        return { ok: true, version, path: cmdPath };
-    }
-    catch {
-        return { ok: false, version: "", path: "" };
-    }
-}
-function isPortListening(port) {
-    if (!Number.isInteger(port) || port < 1 || port > 65535)
-        return false;
-    const p = String(port);
-    const matchesPort = (output) => new RegExp(`:${p}\\s`).test(output);
-    try {
-        if (process.platform === "darwin") {
-            try {
-                const result = execFileSync("lsof", ["-iTCP:" + p, "-sTCP:LISTEN", "-t"], { encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
-                if (result.trim().length > 0)
-                    return true;
-            }
-            catch {
-            }
-            try {
-                const result = execFileSync("ss", ["-tlnp"], { encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
-                if (matchesPort(result))
-                    return true;
-            }
-            catch {
-            }
-            const result = execFileSync("netstat", ["-tlnp"], { encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
-            return matchesPort(result);
-        }
-        // Linux: prefer ss, fall back to netstat
-        try {
-            const result = execFileSync("ss", ["-tlnp"], { encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
-            return matchesPort(result);
-        }
-        catch {
-            const result = execFileSync("netstat", ["-tlnp"], { encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
-            return matchesPort(result);
-        }
-    }
-    catch {
-        return false;
-    }
-}
-function checkSudo() {
-    try {
-        execSync("sudo -n true 2>/dev/null", { timeout: 3000 });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-/** Check if kernel memory cgroup is enabled (required for Docker memory stats on RPi) */
-function isCgroupMemoryEnabled() {
-    try {
-        const cgroups = readFileSync("/proc/cgroups", "utf-8");
-        const memLine = cgroups.split("\n").find(l => l.startsWith("memory\t"));
-        if (!memLine)
-            return false;
-        // Format: name hierarchy num_cgroups enabled
-        return memLine.trim().endsWith("1");
-    }
-    catch {
-        return true; /* non-Linux or unreadable — assume ok */
-    }
-}
-/** Enable cgroup memory in boot cmdline if not already enabled. Returns true if a reboot is needed. */
-export function ensureCgroupMemory() {
-    if (isCgroupMemoryEnabled())
-        return false;
-    const candidates = ["/boot/firmware/cmdline.txt", "/boot/cmdline.txt"];
-    for (const f of candidates) {
-        if (!existsSync(f))
-            continue;
-        try {
-            const content = readFileSync(f, "utf-8").trim();
-            if (content.includes("cgroup_memory=1"))
-                return false; // already in cmdline, just needs reboot
-            const patched = `${content} cgroup_memory=1 cgroup_enable=memory`;
-            execFileSync("sudo", ["cp", f, f + ".bak"], { timeout: 5000 });
-            // Write to tmp file then sudo cp to avoid shell interpolation of file content
-            const tmpPath = join(dirname(f), ".cmdline.tmp");
-            writeSystemTmpFile(tmpPath, patched + "\n");
-            execFileSync("sudo", ["cp", tmpPath, f], { timeout: 5000 });
-            try {
-                unlinkSync(tmpPath);
-            }
-            catch { }
-            console.log(`[setup] enabled cgroup memory in ${f} (reboot required)`);
-            return true;
-        }
-        catch (e) {
-            console.warn(`[setup] failed to patch ${f}:`, e.message);
-        }
-    }
-    return false;
-}
-function canAccessDockerDaemon(timeout = 10000) {
-    const env = buildDockerClientEnv({
-        jishuHome: JISHUSHELL_HOME,
-        colimaProfile: COLIMA_PROFILE,
-    });
-    try {
-        execFileSync("docker", ["info"], { timeout, stdio: "ignore", env });
-        return true;
-    }
-    catch { }
-    try {
-        execFileSync("sudo", ["-n", "docker", "info"], { timeout, stdio: "ignore", env });
-        return true;
-    }
-    catch { }
-    return false;
-}
-function getDockerVersionLine(timeout = 10000) {
-    try {
-        return execFileSync("docker", ["--version"], { encoding: "utf-8", timeout }).trim();
-    }
-    catch { }
-    try {
-        return execFileSync("sudo", ["-n", "docker", "--version"], { encoding: "utf-8", timeout }).trim();
-    }
-    catch { }
-    return "installed";
-}
-export async function getSetupStatus() {
-    // Fast path: if setup is already complete, do lightweight checks before returning cached result
-    const config = getPanelConfig();
-    if (config.service_manager) {
-        const localBin = join(OPENCLAW_BIN_DIR, "openclaw");
-        const localBinOk = existsSync(localBin);
-        const fastDockerImageReady = checkDockerImageExists();
-        const openclawOk = localBinOk || fastDockerImageReady;
-        // Lightweight validation: verify critical services are actually available
-        const dockerOk = canAccessDockerDaemon(5000);
-        const nomadOk = isPortListening(4646);
-        const hasSudo = checkSudo();
-        // If any critical check fails, fall through to the slow full check path
-        if (!openclawOk || !dockerOk || !nomadOk || !hasSudo) {
-            // Fall through to full check below
-        }
-        else {
-            // Fetch real versions (cheap execs, no fallback to slow path)
-            let dockerVer = "installed";
-            try {
-                dockerVer = execFileSync("docker", ["--version"], { encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] }).trim().split("\n")[0];
-            }
-            catch { }
-            let nomadVer = "installed";
-            try {
-                nomadVer = execFileSync(NOMAD_BIN, ["--version"], { encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] }).trim().split("\n")[0];
-            }
-            catch { }
-            let openclawVer = "installed";
-            let openclawPath = localBin;
-            // Prefer npm package.json for accurate OpenClaw version.
-            try {
-                const pkg = join(OPENCLAW_MODULES, "openclaw", "package.json");
-                if (existsSync(pkg))
-                    openclawVer = JSON.parse(readFileSync(pkg, "utf-8")).version || openclawVer;
-            }
-            catch { }
-            const ready = openclawOk && fastDockerImageReady;
-            return {
-                node: { name: "Node.js", installed: true, running: true, version: process.version, path: process.execPath },
-                docker: { name: "Docker", installed: true, running: true, version: dockerVer, path: "" },
-                nomad: { name: "Nomad", installed: true, running: true, version: nomadVer, path: NOMAD_BIN },
-                openclaw: { name: "OpenClaw", installed: openclawOk, running: false, version: openclawVer, path: openclawPath },
-                dockerImageReady: fastDockerImageReady,
-                ready,
-                providerConfigured: !!config.default_provider,
-                hasSudo: true,
-                runtimes: await buildRuntimesStatus(),
-            };
-        }
-    }
-    const NODE_MINIMUM_MAJOR = 22;
-    // Use the currently-running Node binary (process.execPath) as the ground
-    // truth — avoids false-negative when PATH doesn't include nvm's bin dir
-    // (e.g. when started via systemd with a minimal environment).
-    const nodeVersion = process.version;
-    const nodeMajor = parseInt(nodeVersion.replace("v", "").split(".")[0], 10);
-    const nodeStatus = {
-        name: "Node.js",
-        installed: true,
-        running: true,
-        version: nodeVersion,
-        path: process.execPath,
-        needsUpgrade: nodeMajor < NODE_MINIMUM_MAJOR,
-    };
-    const docker = checkCommand("docker");
-    // Use docker info to verify daemon accessibility (not just process existence)
-    // Also try sudo in case the user hasn't logged out since being added to the docker group
-    const dockerRunning = canAccessDockerDaemon(10000);
-    const dockerStatus = {
-        name: "Docker",
-        installed: docker.ok,
-        running: dockerRunning,
-        version: docker.version.split("\n")[0],
-        path: docker.path,
-    };
-    let nomad = checkCommand("nomad");
-    if (!nomad.ok && existsSync(NOMAD_BIN)) {
-        nomad = checkCommand(NOMAD_BIN);
-    }
-    const nomadRunning = isPortListening(4646);
-    const nomadStatus = {
-        name: "Nomad",
-        installed: nomad.ok,
-        running: nomadRunning,
-        version: nomad.version.split("\n")[0],
-        path: nomad.path || NOMAD_BIN,
-    };
-    let openclaw = checkCommand("openclaw");
-    if (!openclaw.ok) {
-        const localBin = join(OPENCLAW_BIN_DIR, "openclaw");
-        if (existsSync(localBin)) {
-            let ver = "installed";
-            try {
-                const pkg = join(OPENCLAW_MODULES, "openclaw", "package.json");
-                if (existsSync(pkg)) {
-                    const pkgJson = JSON.parse(readFileSync(pkg, "utf-8"));
-                    ver = pkgJson.version || "installed";
-                }
-            }
-            catch { }
-            openclaw = { ok: true, version: ver, path: localBin };
-        }
-    }
-    const dockerImageReady = checkDockerImageExists();
-    // If the Docker image already exists, treat openclaw as installed even when
-    // the local npm package is absent — the image is all that's needed to run instances.
-    if (!openclaw.ok && dockerImageReady) {
-        const imageTag = resolveDockerImageTag();
-        const tagVersion = imageTag.split(":").pop() || "local";
-        openclaw = { ok: true, version: tagVersion, path: imageTag };
-    }
-    const openclawStatus = {
-        name: "OpenClaw",
-        installed: openclaw.ok,
-        running: false,
-        version: openclaw.version.split("\n")[0],
-        path: openclaw.path,
-    };
-    const ready = nodeStatus.installed && !nodeStatus.needsUpgrade && dockerStatus.installed && dockerStatus.running && nomadStatus.installed && nomadStatus.running && openclawStatus.installed && dockerImageReady;
-    const providerConfigured = !!getPanelConfig().default_provider;
-    // Read-only check: report whether cgroup memory needs fixing (actual fix is in POST install routes)
-    let needsReboot;
-    if (dockerStatus.installed && !isCgroupMemoryEnabled()) {
-        needsReboot = true;
-    }
-    const runningTasks = getRunningTasks();
-    return { node: nodeStatus, docker: dockerStatus, nomad: nomadStatus, openclaw: openclawStatus, ready, providerConfigured, dockerImageReady, hasSudo: checkSudo(), needsReboot, runningTasks: runningTasks.length ? runningTasks : undefined, runtimes: await buildRuntimesStatus() };
-}
-/**
- * Build the per-runtime install status block by iterating over every
- * registered adapter. A new adapter that implements `getInstallStatus()`
- * automatically appears here — no change required in this function.
- *
- * Each probe is bounded by a short timeout so a hung adapter (slow docker
- * socket, DNS stall) cannot block the `/api/setup/status` endpoint. This
- * mirrors the pattern used by `routes/runtime.ts:probeInstallStatus` so
- * Setup wizard and `/api/runtime/catalog` see a consistent view.
- */
-const BUILD_RUNTIMES_PROBE_TIMEOUT_MS = 2500;
-async function buildRuntimesStatus() {
-    const adapters = listRegisteredAdapters().filter((a) => typeof a.getInstallStatus === "function");
-    const probes = adapters.map(async (adapter) => {
-        try {
-            const status = await Promise.race([
-                Promise.resolve(adapter.getInstallStatus()),
-                new Promise((_, reject) => setTimeout(() => reject(new Error("install-status probe timed out")), BUILD_RUNTIMES_PROBE_TIMEOUT_MS)),
-            ]);
-            if (!status)
-                return null;
-            const sync = status;
-            return [adapter.agentType, { ...sync, required: !!adapter.required }];
-        }
-        catch {
-            return null;
-        }
-    });
-    const out = {};
-    for (const result of await Promise.all(probes)) {
-        if (result)
-            out[result[0]] = result[1];
-    }
-    return Object.keys(out).length ? out : undefined;
-}
-// ── Upgrade Node.js ────────────────────────────────────────────────
-export async function upgradeNode(targetMajor = 22) {
-    try {
-        const current = process.version; // e.g. "v20.20.1"
-        const currentMajor = parseInt(current.replace("v", "").split(".")[0], 10);
-        if (currentMajor >= targetMajor) {
-            return { ok: true, message: `Node.js ${current} already meets requirement (>= ${targetMajor})` };
-        }
-        const task = createTask("node-upgrade");
-        emitTask(task, { type: "progress", message: `升级 Node.js: ${current} → v${targetMajor}`, progress: 0 });
-        if (process.platform === "darwin") {
-            try {
-                execSync("brew --version", { timeout: 5000 });
-            }
-            catch {
-                emitTask(task, { type: "error", message: "未找到 Homebrew" });
-                task.status = "error";
-                return { ok: false, message: "Homebrew not found", error: "Install Homebrew first: https://brew.sh", taskId: task.id };
-            }
-            emitTask(task, { type: "progress", message: `安装 Node.js ${targetMajor} (brew)...`, progress: 20 });
-            const installResult = await spawnWithTask(task, "brew", ["install", `node@${targetMajor}`], { timeout: 300000 });
-            if (!installResult.ok) {
-                emitTask(task, { type: "error", message: "Node.js 安装失败" });
-                task.status = "error";
-                return { ok: false, message: "Node.js install failed", error: installResult.output, taskId: task.id };
-            }
-            emitTask(task, { type: "progress", message: "链接 Node.js...", progress: 80 });
-            try {
-                execSync(`brew link --overwrite --force node@${targetMajor}`, { timeout: 30000 });
-            }
-            catch { }
-        }
-        else {
-            // Use NodeSource setup script
-            emitTask(task, { type: "log", message: "下载 NodeSource 安装脚本..." });
-            emitTask(task, { type: "progress", message: "配置软件源...", progress: 10 });
-            // Use a unique temp path to prevent TOCTOU race: a fixed name like
-            // /tmp/nodesource_setup_22.sh could be replaced by another process
-            // between download (curl) and execution (sudo bash).
-            const nsScriptPath = join(tmpdir(), `nodesource_setup_${targetMajor}_${randomBytes(8).toString("hex")}.sh`);
-            const dlResult = await spawnWithTask(task, "curl", ["-fsSL", `https://deb.nodesource.com/setup_${targetMajor}.x`, "-o", nsScriptPath], { timeout: 60000 });
-            if (!dlResult.ok) {
-                emitTask(task, { type: "error", message: "NodeSource 脚本下载失败" });
-                task.status = "error";
-                return { ok: false, message: "NodeSource script download failed", error: dlResult.output, taskId: task.id };
-            }
-            const setupResult = await spawnWithTask(task, "sudo", ["-E", "bash", nsScriptPath], { timeout: 120000 });
-            if (!setupResult.ok) {
-                emitTask(task, { type: "error", message: "NodeSource 配置失败" });
-                task.status = "error";
-                return { ok: false, message: "Node.js source setup failed", error: setupResult.output, taskId: task.id };
-            }
-            emitTask(task, { type: "progress", message: "安装 Node.js...", progress: 50 });
-            const installResult = await spawnWithTask(task, "sudo", ["apt-get", "install", "-y", "nodejs"], { timeout: 300000 });
-            if (!installResult.ok) {
-                emitTask(task, { type: "error", message: "Node.js 安装失败" });
-                task.status = "error";
-                return { ok: false, message: "Node.js install failed", error: installResult.output, taskId: task.id };
-            }
-        }
-        const newVersion = execSync("node --version", { encoding: "utf-8", timeout: 5000 }).trim();
-        emitTask(task, { type: "done", message: `Node.js 升级完成: ${newVersion}`, progress: 100 });
-        task.status = "done";
-        return { ok: true, message: `Node.js upgraded to ${newVersion}. 请重启 JishuShell 以使用新版本。`, taskId: task.id };
-    }
-    catch (e) {
-        return { ok: false, message: "Node.js upgrade failed", error: e.message };
-    }
-}
-// ── Install Docker (async with progress) ───────────────────────────
-async function installDockerWithTask(task) {
-    try {
-        emitTask(task, { type: "progress", message: "开始安装 Docker...", progress: 0 });
-        // macOS short-circuit: the rest of this function targets apt/get.docker.com,
-        // both of which silently no-op or hard-fail on Darwin. Docker on macOS is
-        // provided by Colima (auto-installed by the bash installer at
-        // install/jishu-install.sh) — not by this code path. Refuse early with a
-        // clear pointer so the user doesn't see a confusing apt error.
-        if (process.platform === "darwin") {
-            const msg = "macOS Docker 需要 Colima。请运行 shell 安装器 (curl -fsSL https://raw.githubusercontent.com/nicepkg/jishushell/main/install/jishu-install.sh | bash),或参阅 docs/macos-colima.md 手动安装 Colima。";
-            emitTask(task, { type: "error", message: msg });
-            task.status = "error";
-            return { ok: false, message: msg, error: "darwin-not-supported-via-this-path" };
-        }
-        const user = execSync("whoami", { encoding: "utf-8", timeout: 5000 }).trim();
-        // ── Try the get.docker.com convenience script ─────────────────
-        emitTask(task, { type: "log", message: "下载 Docker 安装脚本..." });
-        emitTask(task, { type: "progress", message: "下载中...", progress: 5 });
-        // Unique temp path prevents TOCTOU: another user can't swap a fixed /tmp/get-docker.sh
-        // between our download and the sudo sh invocation.
-        const dockerScriptPath = join(tmpdir(), `get-docker_${randomBytes(8).toString("hex")}.sh`);
-        const dlResult = await spawnWithTask(task, "curl", ["-fsSL", "https://get.docker.com", "-o", dockerScriptPath], {
-            timeout: 60000,
-        });
-        let scriptOk = false;
-        if (dlResult.ok) {
-            emitTask(task, { type: "log", message: "运行 Docker 安装脚本..." });
-            const scriptResult = await spawnWithTask(task, "sudo", ["sh", dockerScriptPath], {
-                timeout: 600000,
-                progressParser: (line) => {
-                    if (line.includes("Executing docker install script"))
-                        return 10;
-                    if (line.includes("apt-get update"))
-                        return 20;
-                    if (line.includes("Installing packages"))
-                        return 40;
-                    if (line.includes("docker-ce"))
-                        return 60;
-                    if (line.includes("containerd"))
-                        return 70;
-                    if (line.includes("Created symlink"))
-                        return 85;
-                    return null;
-                },
-            });
-            scriptOk = scriptResult.ok;
-            if (!scriptOk) {
-                emitTask(task, { type: "log", message: "便捷脚本安装失败，尝试 apt 仓库方式..." });
-            }
-        }
-        else {
-            emitTask(task, { type: "log", message: "下载便捷脚本失败，尝试 apt 仓库方式..." });
-        }
-        // ── Fallback: apt-repo manual install (handles Debian trixie pre-releases) ─
-        if (!scriptOk) {
-            emitTask(task, { type: "progress", message: "通过 apt 仓库安装 Docker...", progress: 15 });
-            // Detect system ID + codename; downgrade trixie/sid to bookworm.
-            let codename = "bookworm";
-            let repoOs = "debian";
-            try {
-                const osRelease = readFileSync("/etc/os-release", "utf-8");
-                const codenameMatch = osRelease.match(/^VERSION_CODENAME=(.+)$/m);
-                const distroId = (osRelease.match(/^ID=(.+)$/m)?.[1] || "debian").trim();
-                const raw = (codenameMatch?.[1] || "").trim();
-                repoOs = (distroId === "ubuntu") ? "ubuntu" : "debian";
-                // Debian testing/unstable (trixie, sid) → use the previous stable repo.
-                const unstableCodenames = new Set(["trixie", "forky", "sid", "unstable", "testing"]);
-                const ubuntuFallback = "noble";
-                if (distroId === "ubuntu" && unstableCodenames.has(raw)) {
-                    codename = ubuntuFallback;
-                }
-                else if (unstableCodenames.has(raw)) {
-                    codename = "bookworm";
-                }
-                else {
-                    codename = raw || "bookworm";
-                }
-            }
-            catch { }
-            emitTask(task, { type: "log", message: `使用仓库 codename: ${codename} (OS: ${repoOs})` });
-            const aptSteps = [
-                ["sudo", ["apt-get", "update", "-qq"]],
-                ["sudo", ["apt-get", "install", "-y", "-qq", "ca-certificates", "curl", "gnupg"]],
-                ["sudo", ["install", "-m", "0755", "-d", "/etc/apt/keyrings"]],
-                ["sudo", ["bash", "-c",
-                        `curl -fsSL https://download.docker.com/linux/${repoOs}/gpg | gpg --dearmor --yes -o /etc/apt/keyrings/docker.gpg && chmod a+r /etc/apt/keyrings/docker.gpg`
-                    ]],
-                ["sudo", ["bash", "-c",
-                        `echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/${repoOs} ${codename} stable" > /etc/apt/sources.list.d/docker.list`
-                    ]],
-                ["sudo", ["apt-get", "update", "-qq"]],
-                ["sudo", ["apt-get", "install", "-y", "-qq",
-                        "docker-ce", "docker-ce-cli", "containerd.io", "docker-buildx-plugin", "docker-compose-plugin"
-                    ]],
-            ];
-            const progressSteps = [5, 15, 20, 30, 35, 45, 80];
-            for (let i = 0; i < aptSteps.length; i++) {
-                const [cmd, args] = aptSteps[i];
-                emitTask(task, { type: "progress", message: `${cmd} ${args[0]}...`, progress: progressSteps[i] });
-                const r = await spawnWithTask(task, cmd, args, { timeout: 300000 });
-                if (!r.ok) {
-                    emitTask(task, { type: "error", message: `apt 安装失败 (步骤 ${i + 1}): ${args.join(" ")}` });
-                    task.status = "error";
-                    return { ok: false, message: "Docker apt installation failed", error: r.output, taskId: task.id };
-                }
-            }
-        }
-        // ── Wrap up ────────────────────────────────────────────────────
-        emitTask(task, { type: "progress", message: "配置用户权限...", progress: 90 });
-        try {
-            execFileSync("sudo", ["groupadd", "docker"], { timeout: 10000 });
-        }
-        catch { }
-        try {
-            execFileSync("sudo", ["usermod", "-aG", "docker", user], { timeout: 10000 });
-        }
-        catch { }
-        emitTask(task, { type: "log", message: "注意: Docker 用户组变更可能需要重新登录才能生效" });
-        emitTask(task, { type: "progress", message: "启动 Docker 服务...", progress: 93 });
-        try {
-            execSync("sudo systemctl enable --now docker", { timeout: 30000 });
-        }
-        catch { }
-        // Enable cgroup memory for Docker stats (RPi default has it disabled)
-        const needsReboot = ensureCgroupMemory();
-        if (needsReboot) {
-            emitTask(task, { type: "log", message: "已启用内存 cgroup（需要重启生效，Docker 内存统计才会正常）" });
-        }
-        const version = getDockerVersionLine(10000);
-        // Verify the daemon via `sudo docker` (needed when the current user is not in the docker group yet).
-        const daemonOk = canAccessDockerDaemon(10000);
-        if (daemonOk) {
-            const doneMsg = needsReboot
-                ? `Docker 安装完成: ${version}（需要重启以启用内存统计）`
-                : `Docker 安装完成: ${version}`;
-            emitTask(task, { type: "done", message: doneMsg, progress: 100 });
-            task.status = "done";
-            return { ok: true, message: `Docker installed: ${version}`, needsReboot, taskId: task.id };
-        }
-        else {
-            emitTask(task, { type: "error", message: `Docker 已安装但 daemon 未运行: ${version}` });
-            task.status = "error";
-            return { ok: false, message: `Docker installed but daemon not accessible`, error: "Try: sudo systemctl start docker", taskId: task.id };
-        }
-    }
-    catch (e) {
-        return { ok: false, message: "Docker installation failed", error: e.message };
-    }
-}
-/** Ensure current user is in docker group and service is enabled (idempotent) */
-function ensureDockerPostInstall() {
-    try {
-        const user = execSync("whoami", { encoding: "utf-8", timeout: 5000 }).trim();
-        try {
-            execFileSync("sudo", ["groupadd", "docker"], { timeout: 5000, stdio: "pipe" });
-        }
-        catch { }
-        try {
-            execFileSync("sudo", ["usermod", "-aG", "docker", user], { timeout: 5000 });
-        }
-        catch { }
-        try {
-            execFileSync("sudo", ["systemctl", "enable", "--now", "docker"], { timeout: 10000 });
-        }
-        catch { }
-    }
-    catch { }
-}
-export async function installDocker() {
-    if (canAccessDockerDaemon(5000)) {
-        ensureDockerPostInstall();
-        const needsReboot = ensureCgroupMemory();
-        return { ok: true, message: "Docker already installed", needsReboot };
-    }
-    const task = createTask("docker");
-    return installDockerWithTask(task);
-}
-export function startInstallDocker() {
-    if (canAccessDockerDaemon(5000)) {
-        ensureDockerPostInstall();
-        ensureCgroupMemory();
-        return { ok: true, message: "Docker already installed" };
-    }
-    const task = createTask("docker");
-    void installDockerWithTask(task).catch((err) => {
-        emitTask(task, { type: "error", message: `Docker 安装失败: ${err?.message || err}` });
-        task.status = "error";
-    });
-    return { ok: true, message: "Docker install started", taskId: task.id };
-}
-// ── Install Nomad (async with progress) ────────────────────────────
-function getNomadDownloadUrl() {
-    const arch = process.arch === "arm64" ? "arm64" : "amd64";
-    const os = process.platform === "linux" ? "linux" : "darwin";
-    return `https://releases.hashicorp.com/nomad/${NOMAD_VERSION}/nomad_${NOMAD_VERSION}_${os}_${arch}.zip`;
-}
-/**
- * Signal nomad agents by exact process name (pgrep -x nomad) to avoid the
- * classic pkill -f self-match bug: a command line like "pkill -f 'nomad agent'"
- * literally contains the pattern and pkill kills itself before reaching the
- * real nomad process. pgrep's own comm is "pgrep" (not "nomad") so -x nomad
- * cannot self-match. Unprivileged kill is tried first; sudo -n as a fallback
- * if the running nomad is owned by root (1.6.5 User=root unit).
- */
-function killNomadByProcName() {
-    const collect = () => {
-        try {
-            const out = execSync("pgrep -x nomad 2>/dev/null || true", { encoding: "utf-8" }).trim();
-            return out.split("\n").filter(Boolean);
-        }
-        catch {
-            return [];
-        }
-    };
-    const sendSignal = (sig, pids) => {
-        if (pids.length === 0)
-            return;
-        try {
-            execFileSync("sudo", ["-n", "kill", `-${sig}`, ...pids], { timeout: 5000, stdio: "pipe" });
-            return;
-        }
-        catch { }
-        try {
-            execSync(`kill -${sig} ${pids.join(" ")} 2>/dev/null || true`, { timeout: 5000 });
-        }
-        catch { }
-    };
-    let pids = collect();
-    sendSignal("TERM", pids);
-    if (pids.length > 0) {
-        // Short grace period, then SIGKILL any survivors.
-        execSync("sleep 2");
-        pids = collect();
-        sendSignal("KILL", pids);
-    }
-}
-/** Compare two "a.b.c" semver strings; returns a > b. */
-function isNomadVersionGreater(a, b) {
-    const parse = (v) => v.replace(/^v/, "").split(".").map(n => parseInt(n, 10) || 0);
-    const [aMaj, aMin, aPat] = parse(a);
-    const [bMaj, bMin, bPat] = parse(b);
-    if (aMaj !== bMaj)
-        return aMaj > bMaj;
-    if (aMin !== bMin)
-        return aMin > bMin;
-    return aPat > bPat;
-}
-/**
- * Auto-migrate from a higher Nomad version (e.g. 1.11.3 BSL) back to the
- * jishushell target (1.6.5 MPL). Called when installNomad detects a local
- * binary whose semver is > NOMAD_VERSION. Destructive to Nomad's raft state
- * (schema is not backward compatible) but preserves instance configs under
- * ~/.jishushell/instances/*. A single tar.gz snapshot of the old data_dir
- * is kept under ~/.jishushell/nomad/backups/ for forensic inspection.
- *
- * Safe-first: the new binary is downloaded and verified BEFORE any existing
- * state is touched. If any stage 1 step fails, state is untouched.
- *
- * Throws on failure so the caller's outer catch reports the error.
- */
-async function migrateNomadToTarget(currentVersion) {
-    console.log(`[nomad] Auto-migrating v${currentVersion} → v${NOMAD_VERSION} (BSL → MPL)`);
-    console.log("[nomad]   Raft state is not backward-compatible; allocation history will be reset.");
-    console.log("[nomad]   Instance configs under ~/.jishushell/instances/ are preserved.");
-    // ── Stage 1: download + verify new binary into a staging dir ─────────
-    const stageDir = mkdtempSync(join(tmpdir(), "nomad-migrate-"));
-    let backupFile = "";
-    try {
-        const stagedBin = join(stageDir, "nomad");
-        const zipPath = join(stageDir, "nomad.zip");
-        const url = getNomadDownloadUrl();
-        const arch = process.arch === "arm64" ? "arm64" : "amd64";
-        const os = process.platform === "linux" ? "linux" : "darwin";
-        const sumsUrl = `https://releases.hashicorp.com/nomad/${NOMAD_VERSION}/nomad_${NOMAD_VERSION}_SHA256SUMS`;
-        const sumsPath = join(stageDir, "SHA256SUMS");
-        console.log(`[nomad] Staging v${NOMAD_VERSION} (${os}/${arch})...`);
-        execFileSync("curl", ["-fsSL", url, "-o", zipPath], { timeout: 300000, stdio: "pipe" });
-        execFileSync("curl", ["-fsSL", sumsUrl, "-o", sumsPath], { timeout: 30000, stdio: "pipe" });
-        const sums = readFileSync(sumsPath, "utf-8");
-        const sumLine = sums.split("\n").find(l => l.includes(`nomad_${NOMAD_VERSION}_${os}_${arch}.zip`));
-        if (!sumLine)
-            throw new Error(`No checksum entry for nomad_${NOMAD_VERSION}_${os}_${arch}.zip`);
-        const expected = sumLine.split(/\s+/)[0];
-        // Match the bash installer: prefer sha256sum (GNU coreutils, Linux),
-        // fall back to shasum -a 256 (BSD, macOS default — sha256sum is not
-        // preinstalled there). Without this, triggering auto-migration from
-        // the WebUI / Node path on macOS would fail even though the shell
-        // installer works fine.
-        let actual;
-        try {
-            actual = execSync(`sha256sum "${zipPath}" | awk '{print $1}'`, { encoding: "utf-8" }).trim();
-        }
-        catch {
-            actual = execSync(`shasum -a 256 "${zipPath}" | awk '{print $1}'`, { encoding: "utf-8" }).trim();
-        }
-        if (expected !== actual) {
-            throw new Error(`Nomad checksum mismatch: expected ${expected}, got ${actual}`);
-        }
-        console.log("[nomad] Checksum verified");
-        execFileSync("unzip", ["-o", zipPath, "-d", stageDir], { timeout: 30000 });
-        chmodSync(stagedBin, 0o755);
-        const stagedVersionLine = execFileSync(stagedBin, ["version"], { encoding: "utf-8", timeout: 5000 }).trim().split("\n")[0];
-        if (!stagedVersionLine.includes(`v${NOMAD_VERSION}`)) {
-            throw new Error(`Staged binary reports "${stagedVersionLine}", expected v${NOMAD_VERSION}`);
-        }
-        console.log(`[nomad] Staged ${stagedVersionLine}`);
-        // ── Stage 2: destructive state changes begin ───────────────────────
-        console.log("[nomad] Stopping services...");
-        try {
-            execFileSync("sudo", ["-n", "systemctl", "stop", "jishushell"], { timeout: 15000, stdio: "pipe" });
-        }
-        catch { }
-        try {
-            execFileSync("sudo", ["-n", "systemctl", "stop", "nomad"], { timeout: 15000, stdio: "pipe" });
-        }
-        catch { }
-        // pkill -f 'nomad agent' matches pkill's own cmdline and self-terminates
-        // before reaching the real nomad process. Use pgrep -x nomad (exact proc
-        // name match; pgrep's comm is "pgrep") to avoid the self-match bug.
-        killNomadByProcName();
-        await new Promise(r => setTimeout(r, 2000));
-        // ── Stage 3: tar backup (single snapshot, overwrite any previous) ──
-        const backupDir = join(NOMAD_CONFIG_DIR, "backups");
-        if (existsSync(NOMAD_DATA_DIR)) {
-            try {
-                ensureDirHost(backupDir);
-            }
-            catch { }
-            const ts = new Date().toISOString().replace(/[-:]/g, "").replace(/\..+/, "").replace("T", "-");
-            const candidate = join(backupDir, `data-${ts}.tar.gz`);
-            console.log(`[nomad] Backing up raft state → ${candidate}`);
-            try {
-                execSync(`tar czf "${candidate}" -C "${NOMAD_CONFIG_DIR}" data 2>/dev/null`, { timeout: 120000 });
-                backupFile = candidate;
-                // Keep only the most recent snapshot
-                try {
-                    const list = execSync(`ls -t "${backupDir}"/data-*.tar.gz 2>/dev/null | tail -n +2 || true`, { encoding: "utf-8" }).trim();
-                    for (const old of list.split("\n").filter(Boolean)) {
-                        try {
-                            unlinkSync(old);
-                        }
-                        catch { }
-                    }
-                }
-                catch { }
-            }
-            catch {
-                console.warn("[nomad] Backup tar failed — continuing (raft state will still be wiped)");
-            }
-        }
-        // ── Stage 4: wipe raft state + env files (schema incompatible) ─────
-        try {
-            execFileSync("sudo", ["-n", "rm", "-rf", NOMAD_DATA_DIR], { timeout: 15000, stdio: "pipe" });
-        }
-        catch {
-            try {
-                rmSync(NOMAD_DATA_DIR, { recursive: true, force: true });
-            }
-            catch { }
-        }
-        try {
-            unlinkSync(join(JISHUSHELL_HOME, "nomad.env"));
-        }
-        catch { }
-        try {
-            execFileSync("sudo", ["-n", "rm", "-f", "/etc/jishushell/nomad.env"], { timeout: 5000, stdio: "pipe" });
-        }
-        catch { }
-        // ── Stage 5: orphaned gateway containers ───────────────────────────
-        // Panel normally has docker group via jishushell.service SupplementaryGroups,
-        // but postinstall may run this helper from a shell where the invoking
-        // user is not in docker group. Probe first, fall back to sudo docker.
-        try {
-            let dockerCmd = "docker";
-            try {
-                execSync("docker ps >/dev/null 2>&1", { timeout: 5000 });
-            }
-            catch {
-                dockerCmd = "sudo -n docker";
-            }
-            const names = execSync(`${dockerCmd} ps -a --format '{{.Names}}' 2>/dev/null | grep '^gateway-' || true`, { encoding: "utf-8" }).trim();
-            if (names) {
-                const rows = names.split("\n").filter(Boolean);
-                for (const name of rows) {
-                    try {
-                        execSync(`${dockerCmd} rm -f "${name}" 2>/dev/null`, { timeout: 10000 });
-                    }
-                    catch { }
-                }
-                console.log(`[nomad] Removed ${rows.length} orphaned gateway container(s)`);
-            }
-        }
-        catch { }
-        // ── Stage 6: swap binary into place (atomic via temp name + rename)
-        ensureDirHost(BIN_DIR);
-        const destTmp = `${NOMAD_BIN}.tmp.${process.pid}`;
-        copyFileSync(stagedBin, destTmp);
-        chmodSync(destTmp, 0o755);
-        renameSync(destTmp, NOMAD_BIN);
-        console.log(`[nomad] Migrated to v${NOMAD_VERSION}`);
-        if (backupFile)
-            console.log(`[nomad]   Backup (forensic, not self-recovery): ${backupFile}`);
-        console.log("[nomad]   JishuShell will re-bootstrap ACL and resubmit jobs on next start.");
-    }
-    catch (err) {
-        if (backupFile) {
-            console.error(`[nomad] Migration failed — backup preserved at ${backupFile}`);
-        }
-        throw err;
-    }
-    finally {
-        try {
-            rmSync(stageDir, { recursive: true, force: true });
-        }
-        catch { }
-    }
-}
-export async function installNomad() {
-    try {
-        if (existsSync(NOMAD_BIN)) {
-            // Boundary check 1: is it a regular file?
-            try {
-                const stat = (await import("fs")).statSync(NOMAD_BIN);
-                if (!stat.isFile()) {
-                    try {
-                        unlinkSync(NOMAD_BIN);
-                    }
-                    catch { }
-                }
-            }
-            catch { }
-            if (existsSync(NOMAD_BIN)) {
-                // Boundary check 2: is it executable?
-                try {
-                    chmodSync(NOMAD_BIN, 0o755);
-                }
-                catch { }
-                // Boundary check 3: does it actually run?
-                let versionLine = "";
-                try {
-                    versionLine = execSync(`"${NOMAD_BIN}" version`, { encoding: "utf-8", timeout: 5000 }).trim().split("\n")[0];
-                }
-                catch {
-                    // Binary is corrupt or wrong arch — remove and reinstall
-                    try {
-                        unlinkSync(NOMAD_BIN);
-                    }
-                    catch { }
-                }
-                if (versionLine) {
-                    const match = versionLine.match(/v(\d+\.\d+\.\d+)/);
-                    const currentVersion = match ? match[1] : "";
-                    let migrated = false;
-                    if (currentVersion && isNomadVersionGreater(currentVersion, NOMAD_VERSION)) {
-                        // Current > target — auto-migrate (nomad 1.11.3 BSL → 1.6.5 MPL).
-                        // Migration failure is a hard stop: the old state has been
-                        // partially mutated (or about to be), returning falls through
-                        // to the reinstall path which would make a bad situation worse.
-                        try {
-                            await migrateNomadToTarget(currentVersion);
-                        }
-                        catch (migErr) {
-                            return {
-                                ok: false,
-                                message: "Nomad auto-migration failed",
-                                error: migErr?.message || String(migErr),
-                            };
-                        }
-                        migrated = true;
-                        versionLine = execSync(`"${NOMAD_BIN}" version`, { encoding: "utf-8", timeout: 5000 }).trim().split("\n")[0];
-                    }
-                    // Always (re)write config so the installed nomad.hcl stays up-to-date
-                    // with the current defaults (e.g. raw_exec plugin, acl, limits).
-                    writeNomadConfig();
-                    // Ensure Nomad is started even if already installed
-                    if (!isPortListening(4646)) {
-                        try {
-                            installNomadSystemd();
-                        }
-                        catch { }
-                        if (!isPortListening(4646)) {
-                            await startNomad();
-                        }
-                    }
-                    return migrated
-                        ? { ok: true, message: `Nomad migrated to ${versionLine}` }
-                        : { ok: true, message: `Nomad already installed: ${versionLine}` };
-                }
-            }
-        }
-        // Fallback: if NOMAD_BIN still doesn't exist, check for a system-installed Nomad
-        // (e.g. installed via apt/dnf) and create a symlink so the systemd service path resolves.
-        if (!existsSync(NOMAD_BIN)) {
-            try {
-                const systemNomad = execSync("which nomad 2>/dev/null", { encoding: "utf-8" }).trim();
-                if (systemNomad && existsSync(systemNomad)) {
-                    ensureDirHost(BIN_DIR);
-                    symlinkSync(systemNomad, NOMAD_BIN);
-                    const version = execSync(`${NOMAD_BIN} version`, { encoding: "utf-8", timeout: 5000 }).trim();
-                    console.log(`[nomad] Linked system nomad ${systemNomad} → ${NOMAD_BIN}`);
-                    writeNomadConfig();
-                    return { ok: true, message: `Nomad linked from system: ${version.split("\n")[0]}` };
-                }
-            }
-            catch { /* system nomad not found — proceed to download */ }
-        }
-        const task = createTask("nomad");
-        ensureDirHost(BIN_DIR);
-        const url = getNomadDownloadUrl();
-        const zipPath = join(BIN_DIR, "nomad.zip");
-        emitTask(task, { type: "progress", message: "下载 Nomad...", progress: 0 });
-        const result = await spawnWithTask(task, "curl", ["-fL", "--progress-bar", url, "-o", zipPath], {
-            timeout: 300000,
-            progressParser: curlProgressParser,
-        });
-        if (!result.ok) {
-            emitTask(task, { type: "error", message: "Nomad 下载失败" });
-            task.status = "error";
-            return { ok: false, message: "Nomad download failed", error: result.output, taskId: task.id };
-        }
-        emitTask(task, { type: "progress", message: "解压 Nomad...", progress: 80 });
-        try {
-            execSync("which unzip", { stdio: "ignore" });
-        }
-        catch {
-            emitTask(task, { type: "log", message: "未找到 unzip，尝试安装..." });
-            try {
-                if (process.platform === "linux") {
-                    execSync("sudo apt-get update -qq && sudo apt-get install -y -qq unzip", { timeout: 60000 });
-                }
-                else if (process.platform === "darwin") {
-                    execSync("brew install unzip", { timeout: 60000 });
-                }
-            }
-            catch (e) {
-                emitTask(task, { type: "error", message: "安装 unzip 失败，请手动安装后重试" });
-                throw e;
-            }
-        }
-        execFileSync("unzip", ["-o", zipPath, "-d", BIN_DIR], { timeout: 30000 });
-        chmodSync(NOMAD_BIN, 0o755);
-        try {
-            unlinkSync(zipPath);
-        }
-        catch { }
-        const version = execFileSync(NOMAD_BIN, ["version"], { encoding: "utf-8", timeout: 5000 }).trim();
-        emitTask(task, { type: "done", message: `Nomad 安装完成: ${version}`, progress: 100 });
-        task.status = "done";
-        return { ok: true, message: `Nomad installed: ${version}`, taskId: task.id };
-    }
-    catch (e) {
-        return { ok: false, message: "Nomad installation failed", error: e.message };
-    }
-}
-// ── Configure & start Nomad ────────────────────────────────────────
-/** Fix ~/.jishushell dirs if they were accidentally created as root (e.g. from an old sudo install). */
-function fixNomadDirOwnership() {
-    try {
-        const { statSync } = require("fs");
-        const stat = statSync(NOMAD_CONFIG_DIR);
-        if (stat.uid === 0) {
-            // Directory is owned by root — try to repair with sudo -n (non-interactive)
-            const currentUser = process.env.USER || process.env.LOGNAME || "";
-            if (currentUser) {
-                try {
-                    execFileSync("sudo", ["-n", "chown", "-R", `${currentUser}:${currentUser}`, JISHUSHELL_HOME], { timeout: 10000, stdio: "pipe" });
-                }
-                catch { /* sudo not available or no NOPASSWD — ignore */ }
-            }
-        }
-    }
-    catch { /* stat failed — dir doesn't exist yet, no action needed */ }
-}
-function writeNomadConfig() {
-    fixNomadDirOwnership();
-    ensureDirHost(NOMAD_CONFIG_DIR);
-    ensureDirContainer(NOMAD_DATA_DIR);
-    ensureDirContainer(NOMAD_ALLOC_DIR);
-    const platform = osPlatform();
-    const loopbackIface = platform === "darwin" ? "lo0" : "lo";
-    const externalIface = detectNomadExternalInterface(loopbackIface);
-    const externalHostNetworkBlock = externalIface
-        ? `
-  host_network "external" {
-    interface = "${externalIface}"
-  }
-`
-        : "";
-    // Detect docker0 bridge CIDR so multi-container apps (weknora etc.) can
-    // declare `host_network: docker_bridge` on their ports and have Nomad
-    // publish them on the docker0 IP — which is what `host.docker.internal`
-    // resolves to inside peer containers. Hardcoding 172.17.0.0/16 would
-    // break setups where docker daemon.json overrides `bip` /
-    // `default-address-pools`. Fall back to the Docker default if detection
-    // fails (e.g. docker not yet installed at panel install time; doctor
-    // will regenerate later).
-    const dockerBridgeCidr = detectDockerBridgeCidr() || "172.17.0.0/16";
-    const dockerBridgeHostNetworkBlock = `
-  host_network "docker_bridge" {
-    cidr = "${dockerBridgeCidr}"
-  }
-`;
-    // Apple Silicon CPU fingerprint workaround. Nomad 1.6.x on darwin/arm64
-    // reads `hw.tbfrequency` (timebase, e.g. 24 MHz on M-series) as the CPU
-    // clock, so a 14-core M4 Max reports as 48 MHz total compute and every
-    // job that asks for CPU>48 gets rejected with "Resources exhausted on
-    // dimension cpu". Override with a conservative estimate (cores × 2500
-    // MHz) — M-series base clock is at least 2.5 GHz, so this never
-    // overcommits relative to actual silicon. Intel Macs fingerprint
-    // correctly and don't need the override.
-    const cpuTotalComputeBlock = platform === "darwin" && osArch() === "arm64"
-        ? `  cpu_total_compute = ${osCpus().length * 2500}  # Apple Silicon workaround: Nomad mis-fingerprints CPU freq via tbfrequency\n`
-        : "";
-    // macOS docker driver endpoint. macOS users run Docker via Colima
-    // (managed by this panel under `~/.jishushell/colima/jishushell/`) or
-    // Docker Desktop (`~/.docker/run/docker.sock`); neither exposes
-    // `/var/run/docker.sock` out of the box. Resolve the correct host once
-    // and bake it into the HCL so Nomad doesn't fall back to the default
-    // `unix:///var/run/docker.sock` and fail. Linux keeps the default
-    // (empty endpoint = Docker's standard /var/run/docker.sock).
-    const dockerHost = platform === "darwin"
-        ? resolveDockerHost({ jishuHome: JISHUSHELL_HOME, colimaProfile: COLIMA_PROFILE })
-        : undefined;
-    const dockerEndpointLine = dockerHost ? `\n    endpoint = "${dockerHost}"` : "";
-    const config = `
-data_dir = "${NOMAD_DATA_DIR}"
-
-bind_addr = "127.0.0.1"
-
-leave_on_terminate = false
-
-advertise {
-  http = "127.0.0.1"
-  rpc  = "127.0.0.1"
-  serf = "127.0.0.1"
-}
-
-server {
-  enabled = true
-  bootstrap_expect = 1
-}
-
-client {
-${cpuTotalComputeBlock}  enabled = true
-  servers = ["127.0.0.1:4647"]
-  network_interface = "${loopbackIface}"
-  alloc_dir = "${NOMAD_ALLOC_DIR}"
-${externalHostNetworkBlock}${dockerBridgeHostNetworkBlock}
-
-  # drain_on_shutdown intentionally omitted: on single-node Pi there is
-  # nowhere to drain workloads to, and draining on every systemctl restart
-  # would kill every running OpenClaw instance. Without this block Nomad
-  # leaves allocations running across client restarts — the docker driver
-  # re-attaches to the existing containers on startup.
-}
-
-plugin "docker" {
-  config {${dockerEndpointLine}
-    gc {
-      image = false
-    }
-    volumes {
-      enabled = true
-    }
-  }
-}
-
-plugin "raw_exec" {
-  config {
-    enabled = true
-  }
-}
-
-acl {
-  enabled = true
-}
-
-limits {
-  http_max_conns_per_client = 0
-}
-`;
-    writeConfigFile(join(NOMAD_CONFIG_DIR, "nomad.hcl"), config);
-}
-function detectDockerBridgeCidr() {
-    // `docker network inspect bridge` returns the CIDR for docker0. The exact
-    // value depends on /etc/docker/daemon.json `bip` / `default-address-pools`
-    // — Docker's default is 172.17.0.0/16 but isn't guaranteed. We need the
-    // real value because Nomad uses `host_network "docker_bridge" { cidr = …}`
-    // to pick which interface to publish a port on for specs that declare
-    // `host_network: docker_bridge`. Wrong CIDR → port silently published on
-    // wrong interface → cross-task host.docker.internal calls get refused.
-    try {
-        const raw = execFileSync("docker", ["network", "inspect", "bridge", "--format", "{{(index .IPAM.Config 0).Subnet}}"], { encoding: "utf8", timeout: 3000, stdio: ["pipe", "pipe", "pipe"] }).trim();
-        return /^\d{1,3}(\.\d{1,3}){3}\/\d{1,2}$/.test(raw) ? raw : "";
-    }
-    catch {
-        return "";
-    }
-}
-function detectNomadExternalInterface(loopbackIface) {
-    try {
-        if (osPlatform() === "darwin") {
-            const route = execFileSync("route", ["-n", "get", "default"], {
-                encoding: "utf8",
-                timeout: 3000,
-            });
-            const match = route.match(/interface:\s*(\S+)/);
-            const iface = match?.[1]?.trim() ?? "";
-            return iface && iface !== loopbackIface ? iface : "";
-        }
-        const route = execFileSync("ip", ["route", "show", "default"], {
-            encoding: "utf8",
-            timeout: 3000,
-        });
-        const match = route.match(/\bdev\s+(\S+)/);
-        const iface = match?.[1]?.trim() ?? "";
-        return iface && iface !== loopbackIface ? iface : "";
-    }
-    catch {
-        return "";
-    }
-}
-export function loadNomadToken() {
-    if (process.env.NOMAD_TOKEN)
-        return;
-    const candidates = [
-        join(JISHUSHELL_HOME, "nomad.env"),
-        "/etc/jishushell/nomad.env",
-    ];
-    for (const envFile of candidates) {
-        if (!existsSync(envFile))
-            continue;
-        try {
-            const match = readFileSync(envFile, "utf-8").match(/^NOMAD_TOKEN=(.+)$/m);
-            if (match) {
-                process.env.NOMAD_TOKEN = match[1].trim();
-                return;
-            }
-        }
-        catch {
-            // no read permission, try next candidate
-        }
-    }
-    const legacy = getPanelConfig().nomad_token;
-    if (legacy)
-        process.env.NOMAD_TOKEN = legacy;
-}
-/** Verify the current NOMAD_TOKEN is accepted by the Nomad API. Returns false if it is missing or rejected (HTTP 403/401). */
-async function isNomadTokenValid() {
-    const token = process.env.NOMAD_TOKEN || getPanelConfig().nomad_token;
-    if (!token)
-        return false;
-    try {
-        const resp = await fetch("http://127.0.0.1:4646/v1/acl/token/self", {
-            headers: { "X-Nomad-Token": token },
-            signal: AbortSignal.timeout(5000),
-        });
-        return resp.status === 200;
-    }
-    catch {
-        return false;
-    }
-}
-function nomadApiHeaders(extra = {}) {
-    const token = process.env.NOMAD_TOKEN || getPanelConfig().nomad_token;
-    return token ? { "X-Nomad-Token": token, ...extra } : extra;
-}
-export async function ensureNomadMemoryOversubscriptionEnabled() {
-    try {
-        const resp = await fetch("http://127.0.0.1:4646/v1/operator/scheduler/configuration", {
-            headers: nomadApiHeaders(),
-            signal: AbortSignal.timeout(5000),
-        });
-        if (resp.status !== 200)
-            return;
-        const payload = await resp.json();
-        const scheduler = payload?.SchedulerConfig;
-        if (!scheduler || typeof scheduler !== "object")
-            return;
-        if (scheduler.MemoryOversubscriptionEnabled === true)
-            return;
-        const putResp = await fetch("http://127.0.0.1:4646/v1/operator/scheduler/configuration", {
-            method: "PUT",
-            headers: nomadApiHeaders({ "Content-Type": "application/json" }),
-            body: JSON.stringify({ ...scheduler, MemoryOversubscriptionEnabled: true }),
-            signal: AbortSignal.timeout(5000),
-        });
-        if (putResp.status === 200) {
-            console.log("[nomad] Enabled memory oversubscription so MemoryMaxMB becomes an actual task limit.");
-        }
-        else {
-            console.warn(`[nomad] Failed to enable memory oversubscription: HTTP ${putResp.status}`);
-        }
-    }
-    catch (e) {
-        console.warn("[nomad] Failed to enable memory oversubscription:", e.message);
-    }
-}
-/** Shared post-start sequence: load token, bootstrap ACL, enable oversubscription, enable node. */
-async function finalizeNomadStartup() {
-    loadNomadToken();
-    await bootstrapNomadACL();
-    await ensureNomadMemoryOversubscriptionEnabled();
-    enableNomadNodeEligibility();
-}
-async function bootstrapNomadACL() {
-    // If a token is already loaded, verify it's still valid before trusting it.
-    if (process.env.NOMAD_TOKEN || getPanelConfig().nomad_token) {
-        if (await isNomadTokenValid())
-            return;
-        console.log("[nomad] Stored ACL token is invalid — re-bootstrapping...");
-        delete process.env.NOMAD_TOKEN;
-    }
-    const nomadPath = existsSync(NOMAD_BIN) ? NOMAD_BIN : "nomad";
-    const doBootstrap = async () => {
-        try {
-            const raw = execFileSync(nomadPath, ["acl", "bootstrap", "-json"], {
-                timeout: 10000,
-                encoding: "utf-8",
-                env: { ...process.env, NOMAD_ADDR: "http://127.0.0.1:4646" },
-            });
-            return JSON.parse(raw).SecretID ?? null;
-        }
-        catch (e) {
-            // Return the raw stderr/stdout so caller can inspect it
-            throw e;
-        }
-    };
-    const saveToken = (token) => {
-        const envFile = join(JISHUSHELL_HOME, "nomad.env");
-        const envContent = `NOMAD_TOKEN=${token}\n`;
-        writeSecretFile(envFile, envContent);
-        try {
-            execFileSync("sudo", ["-n", "mkdir", "-p", "/etc/jishushell"], { timeout: 5000, stdio: "pipe" });
-            writeSystemTmpFile("/tmp/.nomad-env-tmp", envContent);
-            execFileSync("sudo", ["-n", "cp", "/tmp/.nomad-env-tmp", "/etc/jishushell/nomad.env"], { timeout: 5000, stdio: "pipe" });
-            execFileSync("sudo", ["-n", "chmod", "600", "/etc/jishushell/nomad.env"], { timeout: 5000, stdio: "pipe" });
-            try {
-                unlinkSync("/tmp/.nomad-env-tmp");
-            }
-            catch { }
-        }
-        catch (copyErr) {
-            console.warn("[nomad] Could not sync token to /etc/jishushell/nomad.env:", copyErr.message);
-        }
-        process.env.NOMAD_TOKEN = token;
-        console.log("[nomad] ACL token saved to", envFile);
-    };
-    try {
-        const token = await doBootstrap();
-        if (token)
-            saveToken(token);
-        return;
-    }
-    catch (e) {
-        const msg = (e.stderr || e.stdout || e.message || "").toString();
-        // "ACL bootstrap already done" — extract reset index and perform a reset
-        const resetMatch = msg.match(/reset index[:\s]+(\d+)/i);
-        if (!resetMatch) {
-            if (!msg.includes("bootstrap"))
-                console.warn("[nomad] ACL bootstrap warning:", msg);
-            return;
-        }
-        const resetIndex = resetMatch[1];
-        console.log(`[nomad] Bootstrap already done (reset index: ${resetIndex}). Performing ACL bootstrap reset...`);
-        // Write the reset trigger file (Nomad reads this on startup to allow re-bootstrap).
-        // NOMAD_DATA_DIR/server is owned by root because nomad.service runs as User=root
-        // (docker driver on 1.6.5 requires euid==0). The panel runs as a non-root user, so
-        // plain writeConfigFile would fail with EACCES — route through `sudo tee` instead.
-        const resetFile = join(NOMAD_DATA_DIR, "server", "acl-bootstrap-reset");
-        try {
-            writeConfigFile(resetFile, resetIndex);
-        }
-        catch (writeErr) {
-            try {
-                execFileSync("sudo", ["-n", "mkdir", "-p", dirname(resetFile)], { timeout: 5000, stdio: "pipe" });
-                execFileSync("sudo", ["-n", "tee", resetFile], {
-                    timeout: 5000,
-                    input: resetIndex,
-                    stdio: ["pipe", "ignore", "pipe"],
-                });
-            }
-            catch (sudoErr) {
-                console.warn("[nomad] Could not write acl-bootstrap-reset file:", sudoErr.message || writeErr.message);
-                return;
-            }
-        }
-        // Restart Nomad so it picks up the reset file
-        try {
-            execFileSync("sudo", ["-n", "systemctl", "restart", "nomad"], { timeout: 15000, stdio: "pipe" });
-        }
-        catch {
-            // No passwordless sudo — try pkill/re-spawn path (best effort)
-            try {
-                execFileSync("sudo", ["-n", "pkill", "-TERM", "-f", "nomad agent"], { stdio: "pipe" });
-            }
-            catch {
-                try {
-                    execFileSync("pkill", ["-TERM", "-f", "nomad agent"], { stdio: "pipe" });
-                }
-                catch { }
-            }
-        }
-        // Wait for Nomad to come back
-        for (let i = 0; i < 20; i++) {
-            await new Promise(r => setTimeout(r, 1000));
-            if (isPortListening(4646))
-                break;
-        }
-        // Bootstrap again — reset file is consumed by Nomad on first start after restart
-        try {
-            const token = await doBootstrap();
-            if (token)
-                saveToken(token);
-        }
-        catch (e2) {
-            console.warn("[nomad] ACL bootstrap after reset failed:", (e2.stderr || e2.message || "").toString().split("\n")[0]);
-        }
-    }
-}
-function enableNomadNodeEligibility() {
-    const nomadPath = existsSync(NOMAD_BIN) ? NOMAD_BIN : "nomad";
-    try {
-        const raw = execSync(`${nomadPath} node status -self -json`, {
-            timeout: 5000,
-            encoding: "utf-8",
-            env: { ...process.env, NOMAD_ADDR: "http://127.0.0.1:4646" },
-        });
-        const nodeId = JSON.parse(raw).ID;
-        if (!nodeId)
-            return;
-        execSync(`${nomadPath} node eligibility -enable ${nodeId}`, {
-            timeout: 5000,
-            env: { ...process.env, NOMAD_ADDR: "http://127.0.0.1:4646" },
-        });
-    }
-    catch {
-    }
-}
-export async function startNomad() {
-    try {
-        const configPath = join(NOMAD_CONFIG_DIR, "nomad.hcl");
-        const readConfig = () => {
-            try {
-                return existsSync(configPath) ? readFileSync(configPath, "utf-8") : "";
-            }
-            catch {
-                return "";
-            }
-        };
-        const oldConfig = readConfig();
-        writeNomadConfig();
-        const newConfig = readConfig();
-        const drifted = oldConfig.length > 0 && newConfig.length > 0 && oldConfig !== newConfig;
-        if (isPortListening(4646)) {
-            // Nomad already running, but if the rewritten config differs (typically
-            // because detectNomadExternalInterface() now resolves to a different
-            // interface — e.g. older install missing the host_network block, or
-            // network interface renamed across reboots), reload nomad so allocations
-            // bind to the right host network on next placement.
-            if (drifted) {
-                try {
-                    execFileSync("sudo", ["-n", "systemctl", "restart", "nomad"], { stdio: "pipe", timeout: 15000 });
-                    for (let i = 0; i < 15; i++) {
-                        await new Promise(r => setTimeout(r, 1000));
-                        if (isPortListening(4646)) {
-                            await finalizeNomadStartup();
-                            return { ok: true, message: "Nomad restarted (config reconciled)" };
-                        }
-                    }
-                    return { ok: false, message: "Nomad restart timed out after config reconcile", error: "Port 4646 not listening after 15s" };
-                }
-                catch (e) {
-                    console.warn(`[nomad] config drift detected but restart failed (${e.message}); existing nomad continues with stale config`);
-                }
-            }
-            await finalizeNomadStartup();
-            return { ok: true, message: "Nomad already running" };
-        }
-        // If systemd manages nomad, delegate to systemctl to avoid spawning a competing process
-        const isSystemdManaged = (() => {
-            try {
-                const result = execFileSync("systemctl", ["is-enabled", "nomad"], { stdio: "pipe", timeout: 3000 });
-                return result.toString().trim() === "enabled";
-            }
-            catch {
-                return false;
-            }
-        })();
-        if (isSystemdManaged) {
-            try {
-                execFileSync("sudo", ["-n", "systemctl", "start", "nomad"], { stdio: "pipe", timeout: 10000 });
-            }
-            catch {
-                // sudo -n failed (no passwordless sudo); service may start on its own
-            }
-            for (let i = 0; i < 15; i++) {
-                await new Promise(r => setTimeout(r, 1000));
-                if (isPortListening(4646)) {
-                    await finalizeNomadStartup();
-                    return { ok: true, message: "Nomad started via systemd" };
-                }
-            }
-            return { ok: false, message: "Nomad start timed out", error: "Port 4646 not listening after 15s" };
-        }
-        if (process.platform === "darwin") {
-            const launchdPlist = join(process.env.HOME || dirname(JISHUSHELL_HOME), "Library/LaunchAgents/com.jishushell.nomad.plist");
-            if (existsSync(launchdPlist)) {
-                for (let i = 0; i < 30; i++) {
-                    await new Promise(r => setTimeout(r, 1000));
-                    if (isPortListening(4646)) {
-                        await finalizeNomadStartup();
-                        return { ok: true, message: "Nomad started" };
-                    }
-                }
-                return { ok: false, message: "Nomad start timed out", error: "Port 4646 not listening after 30s" };
-            }
-        }
-        const nomadPath = existsSync(NOMAD_BIN) ? NOMAD_BIN : "nomad";
-        try {
-            execFileSync(nomadPath, ["version"], { timeout: 5000, stdio: "pipe" });
-        }
-        catch {
-            return { ok: false, message: "Nomad not installed", error: "Install Nomad first" };
-        }
-        const logPath = join(NOMAD_CONFIG_DIR, "nomad.log");
-        // Use spawn with detached to avoid execSync shell injection and ensure proper daemonization
-        try {
-            const { openSync, closeSync } = await import("fs");
-            const logFd = openSync(logPath, "a");
-            // Run as current (non-root) user — Nomad only binds to 127.0.0.1:4646/4647/4648
-            // (non-privileged ports) and all data dirs live under ~/.jishushell/, so sudo is not needed.
-            const cmd = nomadPath;
-            const args = ["agent", `-config=${configPath}`];
-            const child = nodeSpawn(cmd, args, {
-                detached: true,
-                stdio: ["ignore", logFd, logFd],
-            });
-            child.unref();
-            closeSync(logFd);
-        }
-        catch (e) {
-            return { ok: false, message: "Failed to start Nomad", error: `launch failed: ${e.message}. Check sudo/permissions.` };
-        }
-        for (let i = 0; i < 15; i++) {
-            await new Promise(r => setTimeout(r, 1000));
-            if (isPortListening(4646)) {
-                await finalizeNomadStartup();
-                return { ok: true, message: "Nomad started" };
-            }
-        }
-        return { ok: false, message: "Nomad start timed out", error: "Port 4646 not listening after 15s" };
-    }
-    catch (e) {
-        return { ok: false, message: "Failed to start Nomad", error: e.message };
-    }
-}
-export async function stopNomad() {
-    try {
-        if (!isPortListening(4646))
-            return { ok: true, message: "Nomad not running" };
-        // SIGTERM: graceful shutdown — Nomad flushes state and detaches from
-        // running allocs without killing them (drain_on_shutdown is deliberately
-        // not configured, so the docker containers keep running and will be
-        // re-attached when Nomad comes back).
-        // Use killNomadByProcName (pgrep -x) to avoid pkill -f self-matching.
-        killNomadByProcName();
-        // Wait up to 10s for the process to exit. No drain means shutdown is
-        // near-instant — most of this budget is slack for slow disks on Pi.
-        for (let i = 0; i < 10; i++) {
-            await new Promise(r => setTimeout(r, 1000));
-            if (!isPortListening(4646))
-                return { ok: true, message: "Nomad stopped" };
-        }
-        return { ok: true, message: "Nomad stop requested" };
-    }
-    catch (e) {
-        return { ok: false, message: "Failed to stop Nomad", error: e.message };
-    }
-}
-// ── Install Nomad as systemd service ───────────────────────────────
-export function installNomadSystemd() {
-    try {
-        let nomadPath = NOMAD_BIN;
-        if (!existsSync(NOMAD_BIN)) {
-            try {
-                nomadPath = execFileSync("which", ["nomad"], { encoding: "utf-8", timeout: 5000 }).trim();
-            }
-            catch {
-                nomadPath = "nomad";
-            }
-        }
-        const configPath = join(NOMAD_CONFIG_DIR, "nomad.hcl");
-        writeNomadConfig();
-        if (process.platform === "darwin") {
-            // macOS is Apple Silicon only — fail fast (mirrors the bash uname guard).
-            const guard = appleSiliconGuard();
-            if (!guard.ok)
-                return { ok: false, message: guard.message };
-            const laDir = join(process.env.HOME || dirname(JISHUSHELL_HOME), "Library/LaunchAgents");
-            // Always use JishuShell's private Colima socket — hardcoded, not
-            // runtime-detected. Colima may not be running yet when the plist is
-            // written; runtime fallback would pick the wrong socket (Docker
-            // Desktop or /var/run/docker.sock). Mirrors the bash _COLIMA_SOCKET use.
-            const colimaSocket = managedColimaSocketPath(JISHUSHELL_HOME, COLIMA_PROFILE);
-            const colimaDockerHost = managedColimaDockerHost(JISHUSHELL_HOME, COLIMA_PROFILE);
-            // ── 1. Colima self-retrying launchd agent ───────────────────────
-            // colima binary: prefer PATH, fall back to both Homebrew prefixes
-            // (mirrors the bash COLIMA_BIN resolution).
-            let colimaBin = "";
-            try {
-                colimaBin = execFileSync("which", ["colima"], { encoding: "utf-8", timeout: 5000 }).trim().split("\n")[0];
-            }
-            catch {
-                colimaBin = "";
-            }
-            if (!colimaBin && existsSync("/opt/homebrew/bin/colima"))
-                colimaBin = "/opt/homebrew/bin/colima";
-            if (!colimaBin && existsSync("/usr/local/bin/colima"))
-                colimaBin = "/usr/local/bin/colima";
-            if (!colimaBin)
-                colimaBin = "colima";
-            const colimaWrapperPath = join(BIN_DIR, "colima-launchd-wrapper.sh");
-            writeExecutableFile(colimaWrapperPath, buildColimaWrapperScript({
-                colimaHome: _COLIMA_DIR,
-                profile: COLIMA_PROFILE,
-                socket: colimaSocket,
-                colimaBin,
-            }));
-            const colimaPlistPath = join(laDir, "com.jishushell.colima.plist");
-            writeConfigFile(colimaPlistPath, buildColimaPlist({
-                wrapperPath: colimaWrapperPath,
-                colimaHome: _COLIMA_DIR,
-                logPath: join(_COLIMA_DIR, "colima-launchd.log"),
-            }));
-            try {
-                execSync(`launchctl unload "${colimaPlistPath}" 2>/dev/null`);
-            }
-            catch { }
-            try {
-                execSync(`launchctl load -w "${colimaPlistPath}"`, { timeout: 15000 });
-            }
-            catch { }
-            // ── 2. Nomad gated behind a docker-readiness wrapper ────────────
-            const logPath = join(NOMAD_CONFIG_DIR, "nomad.log");
-            const nomadWrapperPath = join(BIN_DIR, "nomad-launchd-wrapper.sh");
-            writeExecutableFile(nomadWrapperPath, buildNomadWaitWrapper({
-                dockerHost: colimaDockerHost,
-                nomadBin: nomadPath,
-                configPath,
-            }));
-            const plistContent = buildNomadPlist({
-                wrapperPath: nomadWrapperPath,
-                dockerHost: colimaDockerHost,
-                logPath,
-            });
-            const plistPath = join(laDir, "com.jishushell.nomad.plist");
-            writeConfigFile(plistPath, plistContent);
-            try {
-                execSync(`launchctl unload "${plistPath}" 2>/dev/null`);
-            }
-            catch { }
-            execSync(`launchctl load -w "${plistPath}"`, { timeout: 15000 });
-            return { ok: true, message: "Nomad launchd agent installed and started (Colima gated)" };
-        }
-        // Nomad 1.6.5's docker driver fingerprint requires euid==0 — PR #18197 lifted
-        // that restriction only in 1.7+, and we intentionally stay on the 1.6 MPL line.
-        // The panel stays as the installing user via a separate jishushell.service unit;
-        // it talks to this agent over HTTP, so no files under ~/.jishushell/nomad/data/
-        // are read directly by the panel.
-        const serviceContent = `[Unit]
-Description=Nomad Agent
-After=network-online.target docker.service
-Wants=network-online.target
-
-[Service]
-User=root
-Type=simple
-EnvironmentFile=-/etc/jishushell/nomad.env
-ExecStart=${nomadPath} agent -config=${configPath}
-Restart=on-failure
-RestartSec=3
-Delegate=yes
-TasksMax=infinity
-
-[Install]
-WantedBy=multi-user.target
-`;
-        const servicePath = "/etc/systemd/system/nomad.service";
-        execFileSync("sudo", ["mkdir", "-p", "/etc/jishushell"], { timeout: 5000 });
-        writeSystemTmpFile("/tmp/nomad.service", serviceContent);
-        execFileSync("sudo", ["cp", "/tmp/nomad.service", servicePath], { timeout: 5000 });
-        execFileSync("sudo", ["systemctl", "daemon-reload"], { timeout: 5000 });
-        execFileSync("sudo", ["systemctl", "enable", "--now", "nomad"], { timeout: 15000 });
-        // Also restart if already running so it picks up the new User= directive
-        try {
-            execFileSync("sudo", ["systemctl", "restart", "nomad"], { timeout: 15000 });
-        }
-        catch { }
-        return { ok: true, message: "Nomad systemd service installed and started" };
-    }
-    catch (e) {
-        return { ok: false, message: "Failed to install Nomad systemd service", error: e.message };
-    }
-}
-// ── Install JishuShell as systemd service ─────────────────────────
-export function installJishushellSystemd(port) {
-    try {
-        const resolvedPort = port || _serverPort;
-        // Use the node binary that is currently running this process — avoids
-        // "which node" failing when PATH doesn't include nvm's bin dir.
-        const nodeBin = process.execPath;
-        // dist/cli.js lives next to this file (dist/services/setup-manager.js → dist/cli.js)
-        const cliBin = join(__dirname, "..", "cli.js");
-        // The real owner home: prefer JISHUSHELL_HOME's parent so we don't rely on $HOME.
-        const realHome = dirname(JISHUSHELL_HOME);
-        if (process.platform === "darwin") {
-            // macOS is Apple Silicon only — fail fast (mirrors the bash uname guard).
-            const guard = appleSiliconGuard();
-            if (!guard.ok)
-                return { ok: false, message: guard.message };
-            const logPath = join(JISHUSHELL_HOME, "panel.log");
-            const wrapperPath = join(JISHUSHELL_HOME, "bin", "jishushell-panel-start");
-            const nomadEnvPath = join(JISHUSHELL_HOME, "nomad.env");
-            const wrapperContent = `#!/bin/sh
-[ -f "${nomadEnvPath}" ] && . "${nomadEnvPath}"
-export JISHUSHELL_HOME="${JISHUSHELL_HOME}"
-export HOME="${realHome}"
-export NODE_ENV=production
-export PATH="/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/usr/local/sbin:/usr/bin:/bin:/usr/sbin:/sbin:${dirname(nodeBin)}:\${PATH}"
-exec "${nodeBin}" "${cliBin}" serve --port ${resolvedPort}
-`;
-            writeExecutableFile(wrapperPath, wrapperContent);
-            // 60s docker-readiness gate so the first post-reboot page load
-            // doesn't flash "image missing"; on timeout it starts anyway
-            // (mirrors the bash panel-launchd-wrapper.sh gate).
-            const gateWrapperPath = join(BIN_DIR, "panel-launchd-wrapper.sh");
-            writeExecutableFile(gateWrapperPath, buildPanelGateWrapper({
-                socket: managedColimaSocketPath(JISHUSHELL_HOME, COLIMA_PROFILE),
-                panelStartWrapper: wrapperPath,
-            }));
-            const plistContent = buildPanelPlist({
-                gateWrapperPath,
-                logPath,
-            });
-            // Symmetric with installNomadSystemd()'s laDir (realHome === dirname(JISHUSHELL_HOME),
-            // so process.env.HOME || dirname(JISHUSHELL_HOME) is provably the same path).
-            const laDir = join(process.env.HOME || dirname(JISHUSHELL_HOME), "Library/LaunchAgents");
-            const plistPath = join(laDir, "com.jishushell.panel.plist");
-            writeConfigFile(plistPath, plistContent);
-            const panelAlreadyRunning = isPortListening(resolvedPort);
-            if (!panelAlreadyRunning) {
-                try {
-                    execSync(`launchctl unload "${plistPath}" 2>/dev/null`);
-                }
-                catch { }
-                execSync(`launchctl load -w "${plistPath}"`, { timeout: 15000 });
-            }
-            return { ok: true, message: "JishuShell launchd agent installed and enabled (port " + resolvedPort + ")" };
-        }
-        const currentUser = resolveServiceUser();
-        const serviceContent = `[Unit]
-Description=JishuShell Panel
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=${currentUser}
-SupplementaryGroups=docker
-Environment=HOME=${realHome}
-Environment=JISHUSHELL_HOME=${JISHUSHELL_HOME}
-EnvironmentFile=-/etc/jishushell/jishushell.env
-EnvironmentFile=-/etc/jishushell/nomad.env
-ExecStart=${nodeBin} ${cliBin} serve --port ${resolvedPort}
-Restart=on-failure
-RestartSec=5
-Environment=NODE_ENV=production
-
-[Install]
-WantedBy=multi-user.target
-`;
-        execFileSync("sudo", ["mkdir", "-p", "/etc/jishushell"], { timeout: 5000 });
-        writeSystemTmpFile("/tmp/jishushell.service", serviceContent);
-        execFileSync("sudo", ["cp", "/tmp/jishushell.service", "/etc/systemd/system/jishushell.service"], { timeout: 5000 });
-        execFileSync("sudo", ["systemctl", "daemon-reload"], { timeout: 5000 });
-        execFileSync("sudo", ["systemctl", "enable", "jishushell"], { timeout: 15000 });
-        // Don't start now — the current process is already running on this port.
-        // The service will auto-start on next reboot.
-        return { ok: true, message: "JishuShell systemd service installed and enabled (port " + resolvedPort + ")" };
-    }
-    catch (e) {
-        return { ok: false, message: "Failed to install JishuShell systemd service", error: e.message };
-    }
-}
-// ── Install OpenClaw (async with progress) ─────────────────────────
-/**
- * Install OpenClaw runtime — thin dispatch wrapper.
- *
- * The heavy lifting lives in `OpenClawAdapter.installRuntime()` (§32.2.4).
- * This wrapper is kept only for back-compat with the existing
- * `routes/setup.ts` endpoint and the CLI installer.
- */
-export async function installOpenclaw(version = "latest") {
-    const adapter = getAdapter("openclaw");
-    if (typeof adapter.installRuntime !== "function") {
-        return { ok: false, message: "OpenClawAdapter.installRuntime is not implemented" };
-    }
-    return adapter.installRuntime({ version });
-}
-// ── Hermes install (§32.1 / §32.3) ─────────────────────────────────
-//
-// Hermes constants (HERMES_DEFAULT_IMAGE, HERMES_RUNTIME_DIR,
-// HERMES_SHIM_FILENAME) and the shim template resolver have moved to
-// `src/config.ts` (§32 Phase 8). setup-manager no longer defines them.
-// The HermesAdapter imports them directly from config.ts.
-/**
- * Capture the immutable digest of a locally-present image so HermesAdapter
- * can pin via digest rather than the mutable tag. Returns undefined if the
- * image has no RepoDigests (e.g. locally-built image) — caller may still
- * proceed using the tag alone.
- */
-export function captureImageDigest(imageRef) {
-    try {
-        const raw = execFileSync("docker", [
-            "image",
-            "inspect",
-            "--format",
-            "{{range .RepoDigests}}{{.}}{{\"\\n\"}}{{end}}",
-            imageRef,
-        ], { encoding: "utf-8", timeout: 10000, stdio: ["pipe", "pipe", "pipe"] });
-        const first = raw.split("\n").map((l) => l.trim()).find(Boolean);
-        return first || undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-/**
- * Install Hermes runtime — thin dispatch wrapper.
- *
- * Heavy lifting lives in `HermesAdapter.installRuntime()` (§32.2.4).
- */
-export async function installHermes() {
-    const adapter = getAdapter("hermes");
-    if (typeof adapter.installRuntime !== "function") {
-        return { ok: false, message: "HermesAdapter.installRuntime is not implemented" };
-    }
-    return adapter.installRuntime();
-}
-/**
- * Non-blocking variant — returns a task id immediately. Implementation
- * dispatches via `HermesAdapter.startInstallRuntime()`.
- */
-export function startInstallHermes() {
-    const adapter = getAdapter("hermes");
-    if (typeof adapter.startInstallRuntime !== "function") {
-        return { ok: false, message: "HermesAdapter.startInstallRuntime is not implemented" };
-    }
-    return adapter.startInstallRuntime();
-}
-/** Helper for setup status — true when runtime catalog has hermes entry. */
-export function isHermesInstalled() {
-    const entry = getRuntimeCatalogEntry("hermes");
-    return !!entry && !!entry.defaultImage;
-}
-export function resolveDockerInvocation() {
-    try {
-        execFileSync("docker", ["info"], { timeout: 5000, stdio: "ignore" });
-        return { cmd: "docker", argsPrefix: [] };
-    }
-    catch { }
-    try {
-        execFileSync("sudo", ["-n", "docker", "info"], { timeout: 5000, stdio: "ignore" });
-        return { cmd: "sudo", argsPrefix: ["-n", "docker"] };
-    }
-    catch { }
-    return { cmd: "docker", argsPrefix: [] };
-}
-function checkDockerImageExists() {
-    const tag = resolveDockerImageTag();
-    try {
-        const invocation = resolveDockerInvocation();
-        execFileSync(invocation.cmd, [...invocation.argsPrefix, "image", "inspect", tag], { timeout: 5000, stdio: "ignore" });
-        return true;
-    }
-    catch {
-        // Fallback scan: list all local images and try to find any known runtime image.
-        // This handles two scenarios:
-        //  1. panel.json was wiped (e.g. after `jishushell reset`) and the pinned version
-        //     tag is no longer stored, causing getOpenclawDockerImage() to return the default
-        //     `:latest` tag which may have been removed locally during the first-run migration.
-        //  2. The environment uses a locally built runtime image (e.g. jishushell-hermes:latest)
-        //     that differs from the registry default.
-        // When a candidate is found we restore panel.json (self-heal) so the fast path works next time.
-        try {
-            const invocation = resolveDockerInvocation();
-            const out = execFileSync(invocation.cmd, [...invocation.argsPrefix, "images", "--format", "{{.Repository}}:{{.Tag}}"], { encoding: "utf8", timeout: 5000 });
-            const lines = out.split("\n").map((l) => l.trim()).filter(Boolean);
-            // 1. Same repository as DEFAULT_OPENCLAW_DOCKER_IMAGE (e.g. after pinned-tag migration).
-            const defaultImage = DEFAULT_OPENCLAW_DOCKER_IMAGE;
-            const repoColonIdx = defaultImage.lastIndexOf(":");
-            const repoSlashIdx = defaultImage.lastIndexOf("/");
-            if (repoColonIdx > repoSlashIdx) {
-                const repo = defaultImage.slice(0, repoColonIdx);
-                const repoPrefix = repo + ":";
-                const found = lines.find((l) => l.startsWith(repoPrefix) && !l.endsWith(":<none>") && !l.endsWith(":none"));
-                if (found) {
-                    setOpenclawDockerImage(found);
-                    return true;
-                }
-            }
-            // 2. Backward compat: older locally-built jishushell-openclaw:* image names.
-            //    These use the same slim base architecture as ghcr.io/x-aijishu/openclaw-runtime:*
-            //    and are fully compatible. Self-heal panel.json so the tag stored there becomes
-            //    the concrete existing tag, preventing repeated DEFAULT-migration side effects.
-            const legacyFound = lines.find((l) => /^jishushell-openclaw:[^\s]+/.test(l) && !l.endsWith(":<none>") && !l.endsWith(":none"));
-            if (legacyFound) {
-                setOpenclawDockerImage(legacyFound);
-                return true;
-            }
-        }
-        catch { }
-        return false;
-    }
-}
-// The stable tag for the JishuShell base image. Reads panel.json — framework-level.
-function resolveDockerImageTag() {
-    return getOpenclawDockerImage();
-}
-// ── Docker image build dispatch wrappers ───────────────────────────────
-//
-// All OpenClaw-specific image build logic now lives in
-// `OpenClawAdapter.buildRuntimeImage()` (§32.2.4 physical migration). These
-// exports remain as thin wrappers so `routes/setup.ts` and
-// `install.ts` callers don't need to learn adapter dispatch.
-/** Blocking: pull or build the OpenClaw docker image. */
-export async function buildSlimOpenclawImage(tag) {
-    const adapter = getAdapter("openclaw");
-    if (typeof adapter.buildRuntimeImage !== "function") {
-        return { ok: false, message: "OpenClawAdapter.buildRuntimeImage is not implemented" };
-    }
-    return adapter.buildRuntimeImage({ tag });
-}
-/** Non-blocking: returns immediately with a task id for SSE polling. */
-export function startBuildSlimOpenclawImage(tag) {
-    const adapter = getAdapter("openclaw");
-    if (typeof adapter.startBuildRuntimeImage !== "function") {
-        return { ok: false, message: "OpenClawAdapter.startBuildRuntimeImage is not implemented" };
-    }
-    return adapter.startBuildRuntimeImage({ tag });
-}
-/** @deprecated Use buildSlimOpenclawImage instead */
-export async function buildCustomOpenclawImage(tag) {
-    return buildSlimOpenclawImage(tag);
-}
-/** @deprecated Use startBuildSlimOpenclawImage instead */
-export function startBuildCustomOpenclawImage(tag) {
-    return startBuildSlimOpenclawImage(tag);
-}
-export async function runFullSetup(options = {}) {
-    const steps = [];
-    let allOk = true;
-    const defaults = {
-        installNomad: true,
-        buildDockerImage: true,
-        ...options,
-    };
-    // Check Docker by daemon accessibility (docker info), not just binary existence
-    const dockerReady = canAccessDockerDaemon(10000);
-    if (!dockerReady) {
-        steps.push({ step: "docker", status: "running", message: "Installing Docker..." });
-        const result = await installDocker();
-        steps[steps.length - 1].status = result.ok ? "done" : "error";
-        steps[steps.length - 1].message = result.message;
-        if (!result.ok)
-            allOk = false;
-    }
-    if (defaults.installNomad) {
-        steps.push({ step: "nomad", status: "running", message: "Installing Nomad..." });
-        const result = await installNomad();
-        steps[steps.length - 1].status = result.ok ? "done" : "error";
-        steps[steps.length - 1].message = result.message;
-        if (!result.ok)
-            allOk = false;
-        if (result.ok) {
-            steps.push({ step: "nomad-systemd", status: "running", message: "Configuring Nomad auto-start..." });
-            const sysResult = installNomadSystemd();
-            steps[steps.length - 1].status = sysResult.ok ? "done" : "error";
-            steps[steps.length - 1].message = sysResult.message;
-            if (!sysResult.ok) {
-                // Fallback to manual start if systemd fails
-                steps.push({ step: "nomad-start", status: "running", message: "Starting Nomad..." });
-                const startResult = await startNomad();
-                steps[steps.length - 1].status = startResult.ok ? "done" : "error";
-                steps[steps.length - 1].message = startResult.message;
-                if (!startResult.ok)
-                    allOk = false;
-            }
-        }
-    }
-    // Prepare each registered agent's runtime artefacts (docker image, shim,
-    // etc.). This loops over every adapter so onboarding a new agent only
-    // requires implementing `buildRuntimeImage` or `installRuntime` in its
-    // adapter — runFullSetup picks it up automatically.
-    if (defaults.buildDockerImage) {
-        // Restart Nomad so it re-detects Docker driver after Docker was installed
-        try {
-            execSync("sudo systemctl restart nomad 2>/dev/null || true", { timeout: 15000 });
-            for (let i = 0; i < 10; i++) {
-                await new Promise(r => setTimeout(r, 2000));
-                if (isPortListening(4646))
-                    break;
-            }
-        }
-        catch { }
-        for (const adapter of listRegisteredAdapters()) {
-            const stepName = `runtime-${adapter.agentType}`;
-            // Prefer buildRuntimeImage (pure docker image prep) over
-            // installRuntime (legacy host-mode npm install). Adapters that only
-            // implement one will use whichever is present; adapters with neither
-            // are skipped silently.
-            const runner = adapter.buildRuntimeImage
-                ? adapter.buildRuntimeImage.bind(adapter)
-                : adapter.installRuntime
-                    ? adapter.installRuntime.bind(adapter)
-                    : null;
-            if (!runner)
-                continue;
-            const isRequired = !!adapter.required;
-            steps.push({
-                step: stepName,
-                status: "running",
-                message: `Preparing ${adapter.agentType} runtime…`,
-            });
-            try {
-                const imgResult = (await runner());
-                const okStep = !!imgResult.ok;
-                steps[steps.length - 1].status = okStep ? "done" : "error";
-                steps[steps.length - 1].message = okStep
-                    ? imgResult.message
-                    : isRequired
-                        ? imgResult.message
-                        : `${imgResult.message} (optional — panel will continue)`;
-                // Required adapter failures abort the overall setup; optional ones
-                // are warnings so that upgrade paths don't break when a third-party
-                // agent's registry is unreachable.
-                if (!okStep && isRequired)
-                    allOk = false;
-            }
-            catch (e) {
-                const msg = e?.message || "runtime prepare failed";
-                steps[steps.length - 1].status = "error";
-                steps[steps.length - 1].message = isRequired
-                    ? msg
-                    : `${msg} (optional — panel will continue)`;
-                if (isRequired)
-                    allOk = false;
-            }
-        }
-    }
-    if (isPortListening(4646)) {
-        await finalizeNomadStartup();
-    }
-    // Only mark setup as complete if all critical steps succeeded
-    if (!allOk) {
-        return { ok: false, steps };
-    }
-    const config = getPanelConfig();
-    config.service_manager = "nomad";
-    config.nomad_driver = "docker";
-    savePanelConfig(config);
-    // Install jishushell systemd service (best-effort — does not block setup completion)
-    steps.push({ step: "jishushell-systemd", status: "running", message: "Configuring JishuShell auto-start..." });
-    const jsResult = installJishushellSystemd();
-    steps[steps.length - 1].status = jsResult.ok ? "done" : "error";
-    steps[steps.length - 1].message = jsResult.message;
-    return { ok: allOk, steps };
-}
-//# sourceMappingURL=setup-manager.js.map